commit f20fad1744380d6231ecd24ab848ebc26ddd5f9f
Author: Joshua Baergen <jbaergen@digitalocean.com>
Date:   Wed May 17 12:17:09 2023 -0600

    rgw: Fix bucket validation against POST policies
    
    It's possible that user could provide a form part as a part of a POST
    object upload that uses 'bucket' as a key; in this case, it was
    overriding what was being set in the validation env (which is the real
    bucket being modified). The result of this is that a user could actually
    upload to any bucket accessible by the specified access key by matching
    the bucket in the POST policy in said POST form part.
    
    Fix this simply by setting the bucket to the correct value after the
    POST form parts are processed, ignoring the form part above if
    specified.

    Signed-off-by: Joshua Baergen <jbaergen@digitalocean.com>

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index a56ecf655a3..b8f3c7b7a4b 100644
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -2660,10 +2660,6 @@ int RGWPostObj_ObjStore_S3::get_params(optional_yield y)
 
   map_qs_metadata(s);
 
-  ldpp_dout(this, 20) << "adding bucket to policy env: " << s->bucket->get_name()
-		    << dendl;
-  env.add_var("bucket", s->bucket->get_name());
-
   bool done;
   do {
     struct post_form_part part;
@@ -2714,6 +2710,10 @@ int RGWPostObj_ObjStore_S3::get_params(optional_yield y)
     env.add_var(part.name, part_str);
   } while (!done);
 
+  ldpp_dout(this, 20) << "adding bucket to policy env: " << s->bucket->get_name()
+		    << dendl;
+  env.add_var("bucket", s->bucket->get_name());
+
   string object_str;
   if (!part_str(parts, "key", &object_str)) {
     err_msg = "Key not specified";